 ;
 ; web services
 
+; XXX might want to disable http from xenabrowser.net, but currently we don't have
+; certs on dev & beta.
 (def trusted-hosts
-  ;#"https://[-_A-Za-z0-9]+.kilokluster.ucsc.edu|https://genome-cancer.ucsc.edu"
-  #".*")
+  ["https?://([-_A-Za-z0-9]+.)?xenabrowser.net"
+   "https://genome-cancer.ucsc.edu"])
+
+(def local-trusted-host "http://localhost(:[0-9]+)?")
 
 (def public-url "https://genome-cancer.ucsc.edu/")
 ;(def public-xena (str public-url "proj/public/xena"))

    (async-post (str ucscPublic-xena "/data/") cohort-query update)
    (async-post (str (local-xena port) "/data/") cohort-query update)))

(defn- wrap-access-control [handler]
  (fn [{:keys [request-method] :as request}]
    (let [response (if (= request-method :options)
                     (response/response "")
                     (handler request))]
      (info "request" request)
      (if-let [origin (re-matches trusted-hosts (get-in request [:headers "origin"] ""))]
        (-> response
            (assoc-in [:headers "Access-Control-Allow-Origin"] origin)
            (assoc-in [:headers "Access-Control-Expose-Headers"] "Location")

   ["-h" "--help" "Show help"]
   ["-H" "--host HOST" "Set host for listening socket" :default "localhost"]
   ["-r" "--root DIR" "Set document root directory" :default docroot-default]
   ["-D" "--localdev" "Allow CORS from localhost" :default false]
   ["-d" "--database FILE" "Database to use" :default db-default]
   [nil "--logfile FILE" "Log file to use" :default logfile-default]
   [nil "--keyfile FILE" "Private key file to use (requires --certfile)"]
